Overview

overview

10

Static

static

3

SecuriteIn...28.exe

windows7-x64

10

SecuriteIn...28.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    143s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230915-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
  • submitted
    18-09-2023 19:36

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    SecuriteInfo.com.Win32.TrojanX-gen.32022.26428.exe

  • Size

    795KB

  • MD5

    102dfca73df9a539a34b886349365381

  • SHA1

    35b90a9ae3dc136502102017c0488c5fc028eae1

  • SHA256

    27216219fbe93818c217c05b66b6586ab58bb000b1c9bc96da93561923f1fce9

  • SHA512

    4335a75a836ebb5c9f589d36bd9b96fa6c3c751ff37caf23805317cdd5082fef0fb3ed198ebdb90cde6e9700d4b0ede2233b6bab8cb421d193c1099510733316

  • SSDEEP

    12288:Q84kSMdr3GNUAn9cNNeX8X/iTS46omh7lZyxa6A0KG384C26ygrxNU4Jpth9+8PZ:Q8fUc6ApGLC7ysxD1d/4e

Score
10/10
xpertratstrigiocollectionevasionpersistencerattrojanupx

Malware Config

Extracted

Family

xpertrat

Version

3.0.10

Botnet

STRIGIO

C2

sandshoe.myfirewall.org:5344

Mutex

I8N3F0X7-G4E2-P2S0-T0D7-R1N2H5T660I4

Signatures

  • UAC bypass 3 TTPs 1 IoCs
    evasiontrojan
  • Windows security bypass 2 TTPs 1 IoCs
    evasiontrojan
  • XpertRAT

    XpertRAT is a remote access trojan with various capabilities.

    ratxpertrat
  • XpertRAT Core payload 1 IoCs
  • NirSoft MailPassView 1 IoCs

    Password recovery tool for various email clients

  • NirSoft WebBrowserPassView 1 IoCs

    Password recovery tool for various web browsers

  • Nirsoft 3 IoCs
  • Adds policy Run key to start application 2 TTPs 2 IoCs
    persistence
  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Windows security modification 2 TTPs 1 IoCs
    evasiontrojan
  • Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
    collection
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
    evasiontrojan
  • Suspicious use of SetThreadContext 7 IoCs
  • Suspicious behavior: EnumeratesProcesses 10 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 61 IoCs
  • System policy modification 1 TTPs 1 IoCs
    evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.TrojanX-gen.32022.26428.exe
    "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.TrojanX-gen.32022.26428.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1956
    • C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.TrojanX-gen.32022.26428.exe
      "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.TrojanX-gen.32022.26428.exe"
      2⤵
        PID:4072
      • C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.TrojanX-gen.32022.26428.exe
        "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.TrojanX-gen.32022.26428.exe"
        2⤵
        • UAC bypass
        • Windows security bypass
        • Windows security modification
        • Checks whether UAC is enabled
        • Suspicious use of SetThreadContext
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        • System policy modification
        PID:1656
        • C:\Program Files (x86)\Internet Explorer\iexplore.exe
          C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.TrojanX-gen.32022.26428.exe
          3⤵
          • Adds policy Run key to start application
          • Adds Run key to start application
          • Suspicious use of SetThreadContext
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:3976
          • C:\Program Files (x86)\Internet Explorer\iexplore.exe
            /stext "C:\Users\Admin\AppData\Roaming\I8N3F0X7-G4E2-P2S0-T0D7-R1N2H5T660I4\wndygdfhx0.txt"
            4⤵
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:5076
          • C:\Program Files (x86)\Internet Explorer\iexplore.exe
            /stext "C:\Users\Admin\AppData\Roaming\I8N3F0X7-G4E2-P2S0-T0D7-R1N2H5T660I4\wndygdfhx1.txt"
            4⤵
            • Accesses Microsoft Outlook accounts
            PID:3864
          • C:\Program Files (x86)\Internet Explorer\iexplore.exe
            /stext "C:\Users\Admin\AppData\Roaming\I8N3F0X7-G4E2-P2S0-T0D7-R1N2H5T660I4\wndygdfhx2.txt"
            4⤵
            • Suspicious behavior: EnumeratesProcesses
            PID:2632
          • C:\Program Files (x86)\Internet Explorer\iexplore.exe
            /stext "C:\Users\Admin\AppData\Roaming\I8N3F0X7-G4E2-P2S0-T0D7-R1N2H5T660I4\wndygdfhx3.txt"
            4⤵
              PID:2524
            • C:\Program Files (x86)\Internet Explorer\iexplore.exe
              /stext "C:\Users\Admin\AppData\Roaming\I8N3F0X7-G4E2-P2S0-T0D7-R1N2H5T660I4\wndygdfhx4.txt"
              4⤵
                PID:3460

        Network

        MITRE ATT&CK Matrix ATT&CK v13

        Initial Access

        Execution

        Persistence

        Boot or Logon Autostart Execution

        2
        T1547

        Registry Run Keys / Startup Folder

        2
        T1547.001

        Privilege Escalation

        Abuse Elevation Control Mechanism

        1
        T1548

        Bypass User Account Control

        1
        T1548.002

        Boot or Logon Autostart Execution

        2
        T1547

        Registry Run Keys / Startup Folder

        2
        T1547.001

        Defense Evasion

        Abuse Elevation Control Mechanism

        1
        T1548

        Bypass User Account Control

        1
        T1548.002

        Impair Defenses

        3
        T1562

        Disable or Modify Tools

        3
        T1562.001

        Modify Registry

        6
        T1112

        Credential Access

        Discovery

        System Information Discovery

        1
        T1082

        Lateral Movement

        Collection

        Email Collection

        1
        T1114

        Exfiltration

        Command and Control

        Impact

        Resource Development

        Reconnaissance

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Roaming\I8N3F0X7-G4E2-P2S0-T0D7-R1N2H5T660I4\wndygdfhx2.txt
          Filesize

          3KB

          MD5

          f94dc819ca773f1e3cb27abbc9e7fa27

          SHA1

          9a7700efadc5ea09ab288544ef1e3cd876255086

          SHA256

          a3377ade83786c2bdff5db19ff4dbfd796da4312402b5e77c4c63e38cc6eff92

          SHA512

          72a2c10d7a53a7f9a319dab66d77ed65639e9aa885b551e0055fc7eaf6ef33bbf109205b42ae11555a0f292563914bc6edb63b310c6f9bda9564095f77ab9196

          Download Submit
        • C:\Users\Admin\AppData\Roaming\I8N3F0X7-G4E2-P2S0-T0D7-R1N2H5T660I4\wndygdfhx4.txt
          Filesize

          2B

          MD5

          f3b25701fe362ec84616a93a45ce9998

          SHA1

          d62636d8caec13f04e28442a0a6fa1afeb024bbb

          SHA256

          b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

          SHA512

          98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

          Download Submit
        • memory/1656-12-0x0000000000400000-0x000000000042C000-memory.dmp
          Filesize

          176KB

          Download
        • memory/1656-26-0x0000000000400000-0x000000000042C000-memory.dmp
          Filesize

          176KB

          Download
        • memory/1656-15-0x0000000000400000-0x000000000042C000-memory.dmp
          Filesize

          176KB

          Download
        • memory/1956-6-0x0000000005710000-0x0000000005728000-memory.dmp
          Filesize

          96KB

          Download
        • memory/1956-16-0x00000000743C0000-0x0000000074B70000-memory.dmp
          Filesize

          7.7MB

          Download
        • memory/1956-7-0x00000000743C0000-0x0000000074B70000-memory.dmp
          Filesize

          7.7MB

          Download
        • memory/1956-8-0x00000000054D0000-0x00000000054E0000-memory.dmp
          Filesize

          64KB

          Download
        • memory/1956-9-0x0000000005770000-0x000000000577A000-memory.dmp
          Filesize

          40KB

          Download
        • memory/1956-10-0x000000000A760000-0x000000000A7CC000-memory.dmp
          Filesize

          432KB

          Download
        • memory/1956-11-0x000000000D870000-0x000000000D90C000-memory.dmp
          Filesize

          624KB

          Download
        • memory/1956-5-0x0000000005230000-0x000000000523A000-memory.dmp
          Filesize

          40KB

          Download
        • memory/1956-4-0x00000000054D0000-0x00000000054E0000-memory.dmp
          Filesize

          64KB

          Download
        • memory/1956-0-0x00000000007A0000-0x000000000086C000-memory.dmp
          Filesize

          816KB

          Download
        • memory/1956-1-0x00000000743C0000-0x0000000074B70000-memory.dmp
          Filesize

          7.7MB

          Download
        • memory/1956-3-0x0000000005270000-0x0000000005302000-memory.dmp
          Filesize

          584KB

          Download
        • memory/1956-2-0x0000000005780000-0x0000000005D24000-memory.dmp
          Filesize

          5.6MB

          Download
        • memory/2524-41-0x0000000000400000-0x0000000000416000-memory.dmp
          Filesize

          88KB

          Download
        • memory/2632-35-0x0000000000400000-0x0000000000459000-memory.dmp
          Filesize

          356KB

          Download
        • memory/3460-42-0x0000000000400000-0x0000000000415000-memory.dmp
          Filesize

          84KB

          Download
        • memory/3864-34-0x0000000000400000-0x000000000041B000-memory.dmp
          Filesize

          108KB

          Download
        • memory/3976-19-0x0000000000400000-0x0000000000443000-memory.dmp
          Filesize

          268KB

          Download
        • memory/5076-33-0x0000000000400000-0x0000000000426000-memory.dmp
          Filesize

          152KB

          Download